Canary Files only require the storage space equivalent to an additional document in the target directory.
Data drawn from an external weather web site is unlikely to successfully match a target directory containing medical records.
Active response for Canary Files could also include the option to quarantine the target directory, or disable removable media, using access control mechanisms similar to the automated physical lock down defences in modern banks.
The other data sets are local statistics from the specific target directory (See Figure 5).
Each set of statistical data is allocated a weight based on their relationship with the target directory. Figure 7 illustrates that statistics obtained from the sibling directory are afforded a higher weighting than statistical data originating from either the entire target domain or the external data set (global).
The current deployment plan is produced using random values and considers each target directory having an equal priority.
This stage involves a scan of the immediate target directory to collect content that can be used to generate the fake files.
Canary Files are generated using data collected from the Internet, environment and target directory in accordance with the previously described process (see Figure 12).